Denial of Service Vulnerability in libcroco: CVE-2017-7961
Summary
ALPINE-CVE-2017-7961: The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco 0.6.11 and 0.6.12 has an "outside the range of representable values of type long" undefined behavior issue, which might allow remote attackers to cause a denial o... Affects libcroco versions < 0.6.13-r1. Fixed in 0.6.13-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libcroco is a library for parsing and manipulating CSS (Cascading Style Sheets) used in various applications to style web content. It provides functionality for handling CSS properties and values, enabling developers to create visually appealing web interfaces. However, certain versions of libcroco are susceptible to a vulnerability that can lead to application crashes when processing malformed CSS files.
Vulnerability Detail
The vulnerability, identified as CVE-2017-7961, arises from the cr_tknzr_parse_rgb function in cr-tknzr.c within libcroco versions 0.6.11 and 0.6.12. It exhibits undefined behavior due to an 'outside the range of representable values of type long' issue. This flaw can be exploited by remote attackers through crafted CSS files, potentially causing a denial of service (application crash) or other unspecified impacts. Although some analyses suggest that the impact may be limited, the risk of application instability remains significant.
How To Fix
Minimum fixed version
0.6.13-r1
This is the first release that contains the fix.
sudo apk add --upgrade libcrocoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted or user-supplied CSS files until the library is updated to a secure version. Implementing strict input validation can also help mitigate the risk of exploitation.
Conclusion
CVE-2017-7961 is a significant vulnerability in libcroco that can lead to application crashes when handling malformed CSS files. It is crucial to update to the patched versions of the library to mitigate the risks associated with this vulnerability. Utilizing tools like Vulert can help monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for libcroco →
FAQ
CVE-2017-7961 is a vulnerability in libcroco that can lead to application crashes when processing malformed CSS files.
Versions 0.6.11 and 0.6.12 of libcroco are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The CVSS score for CVE-2017-7961 is 7.8, indicating a high severity level.
If immediate updates are not possible, avoid processing untrusted CSS files and implement input validation to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for libcroco.
